C4-4.3.11
In negotiating its contract with a service provider, a
(a) Reporting or notification requirements it may wish to impose on the service provider;
(b) Whether sufficient access will be available to its internal auditors, external auditors and to the CBB;
(c) Information ownership rights, confidentiality agreements and Chinese walls to protect client and other information (including arrangements at the termination of the contract);
(d) The adequacy of any guarantees and indemnities;
(e) The extent to which the service provider must comply with the licensee’s policies and procedures (covering, for example, information security);
(f) The extent to which a service provider will provide business continuity for outsourcing operations;
(g) The processes for making changes to the outsourcing arrangement and the conditions under which the licensee or service provider can choose to change or terminate the outsourcing arrangement, such as where there is:
(i) A change of ownership or control (including insolvency or receivership) of the service provider or firm;
(ii) Significant change in the business operations (including sub-contracting) of the service provider or firm; or
(iii) Inadequate provision of services that may lead to the firm being unable to meet its regulatory obligations.
Added: January 2022